Description

A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T03:17:46.863Z",
  "pubdate": "2026-09-04T03:17:46.863Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Doctor Appointment System 1.0, specifically within the /patient/booking.php component. This security flaw stems from the insecure handling of user-supplied input via the 'doc_id' parameter, which is concatenated directly into database queries without sufficient sanitization or parameterization.\nThe vulnerability allows remote, unauthenticated attackers to manipulate backend database queries. Successful exploitation can lead to unauthorized data extraction, modification, or deletion within the underlying database. Given that the exploit is currently public, the system is at high risk of automated exploitation attempts.\nThe impact includes potential loss of sensitive patient and administrative data, compromise of system integrity, and possible unauthorized access to the application's backend architecture. Immediate remediation is required to prevent unauthorized data exposure.",
  "technicalDetails": "The vulnerability is classified as an SQL injection (SQLi), specifically occurring within the /patient/booking.php file of the Doctor Appointment System 1.0. The root cause is the improper neutralization of special elements used in an SQL command, which occurs because the application fails to utilize prepared statements or parameterized queries when processing the 'doc_id' argument.\nWhen a user interacts with the booking functionality, the 'doc_id' parameter is passed to the server to identify the target physician. The backend code fails to validate or escape this input, allowing an attacker to inject arbitrary SQL syntax into the query string. By appending malicious SQL payloads to the 'doc_id' parameter (e.g., using UNION-based or error-based injection techniques), an attacker can alter the query logic to bypass authentication, expose the database structure, or extract sensitive contents from other tables such as user credentials, appointment logs, or personal health information.\nThe attack flow proceeds as follows: First, the attacker identifies that the 'doc_id' parameter is reflected in the backend SQL database queries. Second, the attacker crafts a malicious request by submitting a crafted string via the 'doc_id' parameter. Third, the database engine executes the injected SQL commands alongside the legitimate query. Finally, the application returns the result of the injected query, often revealing sensitive information in the response, or confirms the success of a data modification command.\nBecause the application is accessible remotely, no prior authentication is required to initiate the attack. The exploit is public, meaning that threat actors can leverage automated tools to scan and exploit this vulnerability systematically. Post-exploitation impact is severe, potentially leading to a full database compromise, unauthorized modification of appointment schedules, and systemic exposure of private patient records."
}